cbcvebase.
CVE-2012-1506
published 2014-09-17

CVE-2012-1506: SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute…

PriorityP337medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EXPLOIT
EPSS
1.30%
66.9th percentile
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from third party information.

Affected

19 ranges
VendorProductVersion rangeFixed in
orangehrmorangehrm<= 2.6.12.1—
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
orangehrmorangehrm——
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.